CareComply Privacy Policy

Overview

CareComply, Inc. (“CareComply,” “we,” “us,” or “our”) provides a daily compliance audit report service to healthcare facilities and other organizations (each, a “Customer”). This Privacy Policy describes how we collect, use, share, and protect information when you visit our website, interact with our services, apply for a job with us, or otherwise engage with us.

Because our service involves health information, this policy also explains the role we play under the Health Insurance Portability and Accountability Act (“HIPAA”) and how privacy obligations are divided between CareComply and our Customers.

1. Scope of this Policy

This Privacy Policy applies to information processed by CareComply about:

• Visitors to our website at carecomply.ai.
• Administrators and authorized users of CareComply's services, on behalf of Customers.
• Individuals who contact us, request information, or apply for employment with CareComply.

This Privacy Policy does not apply to:

• Protected Health Information (“PHI”) that CareComply processes on behalf of a Customer in CareComply's capacity as a HIPAA Business Associate. Such PHI is governed by the Business Associate Agreement (“BAA”) between CareComply and the relevant Customer, and by that Customer's own Notice of Privacy Practices. See Section 6 (HIPAA and our Business Associate role).
• Third-party websites or services that link to or from our service. Their privacy practices are governed by their own policies.

2. Information We Collect

2.1 Information you provide to us

• Account and registration information: name, business email address, job title, employer / organization, password (hashed), and similar identifiers when an authorized user is provisioned to use our service.
• Communications: information you provide when you contact us, request a demo, complete a contact form, respond to a survey, or correspond with our support team.
• Job applications: resume / CV, work history, references, and any other information you submit through our careers page or to a recruiter.
• Payment and billing information: business contact and billing details. Payment card information is processed by our third-party payment processor; we do not store full card numbers on our systems.

2.2 Information collected automatically

• Usage data: pages visited, features used, session start and end times, click and scroll events, and similar interaction data.
• Device and connection data: IP address, browser type and version, operating system, time-zone setting, device identifiers, and crash diagnostics.
• Cookies and similar technologies: see Section 11 (Cookies and tracking).

2.3 Customer Data, including PHI

When a Customer uses CareComply, the Customer or its authorized users may upload, transmit, or otherwise provide data to our service (“Customer Data”). Customer Data may include PHI, such as patient identifiers, clinical records, treatment notes, and information about facility audits. CareComply processes Customer Data, including any PHI it contains, on behalf of the Customer in CareComply's role as a Business Associate, subject to the BAA between CareComply and that Customer. The Customer is responsible for the lawful basis on which it collects and provides Customer Data to us.

2.4 Information from third parties

• Marketing and analytics partners may provide information about your visit to our website, including referral source and inferred interests.
• For applicants and contractors, we may receive identity-verification or background-check information from a vendor with your authorization where lawful.
• Publicly available information about Customer organizations (for example, from government registries or LinkedIn) used for sales and onboarding.

3. How We Use Information

We use the information described above for the following purposes:

• To provide, maintain, and improve the CareComply service, including generating the daily compliance audit reports our Customers contract for.
• To process transactions, send transactional communications (account notices, invoices, security alerts), and respond to requests.
• To provide customer support, train our personnel, and troubleshoot issues.
• To detect, prevent, and respond to security incidents, fraud, and abuse, and to comply with our security and HIPAA obligations.
• To comply with applicable laws, regulations, contracts, court orders, or other valid legal process.
• With your consent, to send you marketing communications about CareComply. You can opt out at any time using the unsubscribe link in our emails or by contacting us.

PHI is used by CareComply only as permitted by the applicable BAA and HIPAA, and only as necessary to provide the contracted service or as otherwise allowed by law.

4. How We Share Information

We do not sell personal information. We share information only as described below.

4.1 Service providers and subprocessors

We use a limited set of service providers to operate our business and deliver our service. These include:

• Amazon Web Services (“AWS”), our cloud infrastructure provider.
• Google Workspace (email and customer-support provider).

Where a service provider may access PHI on our behalf, that provider executes a HIPAA Business Associate Agreement with CareComply before access is granted. A current list of subprocessors that may access Customer Data, including PHI, is available upon request.

4.2 Customers and the people they authorize

Where you use CareComply as an authorized user of a Customer's account, we share information about your use of the service with that Customer, including activity logs, the records you accessed, and any content you submit through the service. The Customer's own policies and privacy notices govern its handling of that information.

4.3 Legal and safety reasons

We may disclose information if we believe in good faith that disclosure is required or permitted by law, including in response to a subpoena, court order, or other valid legal process; to enforce our agreements; to protect the rights, property, or safety of CareComply, our Customers, or others; or to address a security incident.

4.4 Corporate transactions

If CareComply is involved in a merger, acquisition, financing, reorganization, sale of all or a portion of its assets, or similar transaction, information about our users and Customers may be transferred as part of that transaction, subject to standard confidentiality protections and continuation of the obligations in this Privacy Policy.

5. Data Retention

We retain information only as long as needed for the purposes described in this Privacy Policy, to comply with our legal obligations (including HIPAA's six-year documentation retention requirement, where applicable), to resolve disputes, and to enforce our agreements.

• Account data is retained while a Customer's account is active and for a reasonable period after termination as required for contract close-out, legal, and audit purposes.
• Customer Data, including PHI, is retained per the applicable BAA and Customer agreement. By default, Customer Data is deleted or returned within ninety (90) days of contract termination, unless retention is required by law.
• Security incident records and other HIPAA-required documentation are retained for at least six (6) years.
• Job application information is retained for the period required by applicable law and our internal hiring policies.

6. HIPAA and our Business Associate Role

CareComply provides services to healthcare facilities, health plans, and other entities that are HIPAA Covered Entities or Business Associates. When we process PHI on behalf of a Customer, we act as the Customer's Business Associate under HIPAA.

In our capacity as a Business Associate:

• We use and disclose PHI only as permitted by the BAA between CareComply and the Customer.
• We have implemented the administrative, physical, and technical safeguards required by the HIPAA Security Rule, including encryption of PHI at rest and in transit, access controls with multi-factor authentication, audit logging, workforce training, and an incident response program.
• We do not engage subcontractors that will access PHI on our behalf without a written Business Associate Agreement.
• We notify the affected Customer of any Breach of Unsecured PHI without unreasonable delay and in accordance with the BAA and 45 CFR §§ 164.400–414.

If you are an individual whose PHI may be processed by CareComply on behalf of a Customer, your HIPAA rights—including the right to access (45 CFR § 164.524), the right to request amendment (§ 164.526), and the right to an accounting of disclosures (§ 164.528)—are exercised through the Covered Entity that is your healthcare provider, plan, or other covered relationship. CareComply will support its Customers in responding to such requests as required by the applicable BAA.

7. Data Security

CareComply maintains a written information security program that includes the following safeguards:

• Encryption of PHI and other Confidential Data at rest using AES-256 (or equivalent) and in transit using TLS 1.2 or higher.
• Identity and access management with role-based access controls, the principle of least privilege, and multi-factor authentication on privileged access.
• Continuous monitoring, audit logging, and incident detection across our production environment.
• Annual third-party security assessments, including a penetration test, and a SOC 2 Type II examination of our system.
• Workforce training (including HIPAA workforce training where required) at onboarding and annually thereafter.
• A documented Incident Response Plan with defined severity, containment, and notification timeframes.

No security program can eliminate all risk. If you believe a security or privacy incident has occurred, please contact us immediately using the contact information in Section 13.

8. Your Privacy Rights

Depending on where you live and your relationship with CareComply, you may have certain rights regarding your personal information.

8.1 Rights regarding PHI

As described in Section 6, HIPAA rights regarding your PHI are exercised through the Covered Entity that is your healthcare provider or plan. We will support that Covered Entity in fulfilling your request as required by the applicable BAA.

8.2 California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what categories of personal information we have collected, the sources, the purposes, and the categories of recipients.
• Request a copy of the specific pieces of personal information we have collected about you.
• Request that we delete personal information we collected from you, subject to legal exceptions.
• Request that we correct inaccurate personal information.
• Opt out of the “sale” or “sharing” of personal information, as those terms are defined under the CCPA. CareComply does not sell personal information.
• Limit the use and disclosure of sensitive personal information.
• Not be discriminated against for exercising any of these rights.

PHI processed under HIPAA is generally exempt from the CCPA. Where the CCPA does apply, you may exercise your rights using the contact information in Section 13. We will verify your identity before responding and will respond within forty-five (45) days as required by California law.

8.3 EU, UK, and other GDPR-aligned jurisdictions

If you are located in the European Economic Area, United Kingdom, or another jurisdiction that grants similar rights, you may have the right to access, correct, delete, restrict, port, or object to certain processing of your personal data. To exercise these rights, contact us using the information in Section 13. You also have the right to lodge a complaint with your local data protection authority.

9. International Data Transfers

CareComply is based in the United States and processes information in the United States. If you access our services from outside the United States, your information will be transferred to, processed in, and stored in the United States. Where we transfer personal data from the European Economic Area, United Kingdom, or Switzerland to the United States, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses, where required by applicable law.

10. Children's Privacy

Our website and services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13 through our website. PHI of minors may be processed by CareComply only as part of services we provide to a Covered Entity Customer, subject to that Customer's authority over its patients' information and applicable law (including the HIPAA Privacy Rule).

11. Cookies and Tracking

We use cookies and similar technologies on our website for the following purposes:

• Strictly necessary cookies: required for the website to function (for example, to keep you signed in).
• Analytics cookies: help us understand how visitors use our website so we can improve it.

You can control non-essential cookies through the cookie preferences interface on our website or through your browser settings. We honor Global Privacy Control (“GPC”) signals from your browser where applicable.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page with a new “Last updated” date. For material changes, we will provide additional notice (for example, by email to account holders or by a banner on our website). Your continued use of CareComply after the effective date of an updated Privacy Policy indicates your acceptance of the updates.

13. Contact Us

If you have any questions or requests regarding this Privacy Policy or our handling of your personal information, please contact us:

• Email: security@carecomply.ai

For data subject requests or questions about your rights under applicable privacy laws, please mark your communication “Privacy Request” in the subject line. We will respond as required by law.